Take the indexer's verdict on a manifest instead of judging it, and name a held module (ADR 0578)

Issue 1585, S17: the engine decodes manifests leniently; a module whose manifest the indexer refused is held and named,
its data key stands, and every other module's items are still published. Policy, HoldsData and the certificate check no
longer parse with the judge.

Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL

internal/selfcompose/selfcompose.go

@@ -110,6 +110,7 @@ type Composer struct {
 	// at a build of the old form): the node runs it inside its own composition, and composes it there again (issue 1126).
 	inOwn     map[string]bool
 	modules   map[string]delivery.Module
+	told      map[string]bool           // lines said once each (sayOnceEach)
 	values    map[string]map[string]any // by module, this node's
 	manifests map[string][]byte         // by digest, read once
 	archives  map[string][]byte         // templates archives by digest, read once
@@ -1052,8 +1053,8 @@ func (c *Composer) Policy(ctx context.Context, module string) string {
 	if err != nil {
 		return ""
 	}
-	parsed, err := catalogue.ParseManifestForInputs(raw)
-	if err != nil {
+	parsed, held, err := c.taken(module, m, raw)
+	if err != nil || held != "" {
 		return ""
 	}
 	policy, _, _ := catalogue.DerivedUpgrade(parsed)
@@ -1074,13 +1075,51 @@ func (c *Composer) HoldsData(ctx context.Context, module string) (data, known bo
 	if err != nil {
 		return false, false
 	}
-	parsed, err := catalogue.ParseManifestForInputs(raw)
-	if err != nil {
+	parsed, held, err := c.taken(module, m, raw)
+	if err != nil || held != "" {
 		return false, false
 	}
 	return len(parsed.DataItems()) > 0, true
 }
 
+// taken is a module's manifest as this engine reads it (novox/hq ADR 0578 §3): decoded leniently, judging nothing, with
+// the indexer's verdict from the module's value (a missing one is accepted). held is why the module is held, "" when it is
+// not: a manifest the indexer refused, or one not read past a field this engine does not know. A field set aside is said
+// once, and an error is returned only for bytes that are no manifest, which the caller says in its own words.
+func (c *Composer) taken(module string, m delivery.Module, raw []byte) (man catalogue.Manifest, held string, err error) {
+	if v := m.VerdictOf(module); v != nil {
+		if refused, _ := delivery.TakeManifestVerdict(v); refused {
+			return catalogue.Manifest{}, v.Why(), nil
+		}
+	}
+	man, err = catalogue.Decode(raw)
+	if err != nil {
+		c.sayOnceEach("the manifest of " + module + " does not decode, and the module is held: " + err.Error())
+		return man, "", err
+	}
+	if aside := man.SetAside(); aside != "" {
+		c.sayOnceEach("the manifest of " + module + " has a field this engine does not know, set aside: " + aside)
+		if man.ReadNoFurther() {
+			return man, aside, nil
+		}
+	}
+	return man, "", nil
+}
+
+// sayOnceEach says a line the first time only, apart from sayOnce's single current line.
+func (c *Composer) sayOnceEach(line string) {
+	c.mu.Lock()
+	if c.told == nil {
+		c.told = map[string]bool{}
+	}
+	again := c.told[line]
+	c.told[line] = true
+	c.mu.Unlock()
+	if !again {
+		c.env.Say(line)
+	}
+}
+
 // reader is the composer's view of the bus as frombus reads it.
 type reader struct{ c *Composer }
 
@@ -1109,7 +1148,14 @@ func (c *Composer) certificateWanted(ctx context.Context, r reader, p delivery.P
 		if err != nil {
 			continue
 		}
-		if parsed, err := catalogue.ParseManifestForInputs(raw); err == nil && parsed.Certificate != nil {
+		c.mu.Lock()
+		mod := c.modules[m.Module]
+		c.mu.Unlock()
+		parsed, held, err := c.taken(m.Module, mod, raw)
+		if err != nil || held != "" {
+			continue // held or not read: it asks none, and its refusal is named by the composition
+		}
+		if parsed.Certificate != nil {
 			return true
 		}
 	}